docs(framework): P3.1 fast-follow — governance wording + gate scope + bare-launch note

Non-blocking items from the #575 dual-engine review:
- CONSTITUTION.md: state explicitly there is NO CONSTITUTION.local.md and hard
  gates are not locally overridable (clarity vs LAYER-MODEL overlay-eligibility)
- verify-sanitized.sh: expand identity scan to *.yml/*.yaml/*.toml/*.env/*.service
  (operator data could hide in shipped configs) — gate green, no new hits
- AGENTS.md: clarify the intentional bare-launch stop-if-missing strictness vs the
  launcher's readOptional tolerance (which keeps pre-upgrade hosts working)

Refs #542, closes #576

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/mosaic/framework/defaults/CONSTITUTION.md

@@ -2,8 +2,11 @@
 
 The irreducible, non-negotiable law for every Mosaic agent on every harness.
 
-**Framework-owned.** This file is overwritten verbatim on every upgrade — do not edit it. To change
-behavior, add a `.local.md` overlay or a `policy/` file (tighten-only; see `constitution/LAYER-MODEL.md`).
+**Framework-owned.** This file is overwritten verbatim on every upgrade — do not edit it. There is
+**no `CONSTITUTION.local.md`**: hard gates are not locally overridable. A lower layer may only make
+behavior _stricter_, never relax or override a gate (see Precedence). Operator customization lives in
+other layers — `SOUL.md` / `USER.md` and the tighten-only overlays `STANDARDS.local.md` /
+`SOUL.local.md` / `USER.local.md` / `policy/*.md` (see `constitution/LAYER-MODEL.md`).
 Authored in **capability verbs**: where a gate names a capability ("structured reasoning", "queue
 guard"), the runtime adapter binds it to a concrete tool and states whether absence is a hard stop.